Artificial intelligence based optimization with deep learning model for blockchain enabled intrusion detection in CPS environment

Cyber physical system (CPS) is a network of cyber and physical elements, which interact with one another in a feedback form. CPS approves critical infrastructure and is treated as essential in day to day since it forms the basis of futuristic smart devices. An increased usage of CPSs poses security as a challenging issue and intrusion detection systems (IDS) can be applied for the identification of network intrusions. The latest advancements in the field of artificial intelligence (AI) and deep learning (DL) enables to design effective IDS models for the CPS environment. At the same time, metaheuristic algorithms can be employed as a feature selection approach in order to reduce the curse of dimensionality. With this motivation, this study develops a novel Poor and Rich Optimization with Deep Learning Model for Blockchain Enabled Intrusion Detection in CPS Environment, called PRO-DLBIDCPS technique. The proposed PRO-DLBIDCPS technique initially introduces an Adaptive Harmony Search Algorithm (AHSA) based feature selection technique for proper selection of feature subsets. For intrusion detection and classification, and attention based bi-directional gated recurrent neural network (ABi-GRNN) model is applied. In addition, the detection efficiency of the ABi-GRNN technique has been enhanced by the use of Poor and rich optimization (PRO) algorithm based hyperparameter optimizer, which resulted in enhanced intrusion detection results. Furthermore, blockchain technology is applied for enhancing security in the CPS environment. In order to demonstrate the enhanced outcomes of the PRO-DLBIDCPS technique, a wide range of simulations was carried out on benchmark dataset and the results reported the better outcomes of the PRO-DLBIDCPS technique in terms of several measures.


Methods
In this study, a new PRO-DLBIDCPS technique has been developed for intrusion detection in the CPS environment. The PRO-DLBIDCPS technique encompasses different processes namely pre-processing, AHSA for election of features, ABi-GRNN classifier, and PRO hyperparameter optimizer. The detection efficiency of the ABi-GRNN technique has been enhanced by the use of PRO algorithm based hyperparameter optimizer, which results in enhanced intrusion detection results. The overall system architecture is shown in Fig. 2.
Blockchain technology. In this work, blockchain technology is included to boost security in the CPS environment. A blockchain is an immutable distributed dataset where new time-stamped transaction is grouped and appended into a hash-chain of block 16 . The structure of the blockchain is given in Fig. 3. The fundamental blockchain protocols define how many copies of the block could be maintained and constructed in a distributed manner. A crucial factor of this protocol is deciding how a network of participants, called a miner, could determine consensus on the present state of the blockchain. There are distinct kinds of blockchain architecture (that is., private, public, permissioned, and permission-less). There are two prevalent approaches for the same, such as Proof of Stake (PoS) and Proof of Work (PoW). When this task is completed, the new transaction is added to the blockchain. All the blocks contain a unique code named a hash, which contain hash of the preceding block in the chain, and is utilized for connecting the block together in a certain order. Some miner should implement a set of computations for establishing the credibility as a leader. This computation resolves a puzzle for mapping random sized data to a fixed size. In other networks, a leader could be selected in one of these two methods. In Proof of Work (PoW), several miner tries to resolve the puzzle and the one that finished first, broadcasted to the group proof that the work is completed. Then, other miner validates that the work completed is correct. When each one verifies this, they choose that certain miner as the leader. The main goal of the block is to preserve a list of confirmed transaction with a cryptographic hash function. The hash function is effective due to the subsequent property.
• It produces an output of fixed length regardless of the input length.
• It is deterministic that generate similar output for a provided input.
• It is irrevocable that getting similar input from the output is impossible.
• Any perturbation to the original input generates new output.
• The hash computation is faster with minimal overhead.
The block in the blockchain is connected to the initial genes is block and confirmed by the hashes. Each block is linked via the relationship of each hash, which implies all the blocks have the prior hash, and further get hashed in the following block. Any such modification to the hash causes the chain to be broken since the original hash is attached to the following block in the chain. Recalculate the original hash for restoring the chain   www.nature.com/scientificreports/ require a massive number of computational power. Additionally, the nonce is added thus the miner plays with the data to generate a hash that output three zeroes. When the miner has found a nonce that leads to block hash being under the difficult threshold, finally considered the block is valid, and it is broadcasted to the network. As blockchain can protect the integrity of data storage and ensure process transparency, it has a potential to be applied to intrusion detection domain 17 . The lack of universal trust implies a need for a distributed consensus mechanism for block validation in blockchain networks. Blockchain based Anamoly detection approaches have been used to enhance security. For details refer 18,19 . Design of AHSA-FS technique. Primarily, the networking data is pre-processed and is passed into the AHSA-FS technique for choosing feature subsets. HSA is a metaheuristic algorithm, stimulated from the basic principle of the musician's inventiveness of the harmony. The control parameters were bandwidth (BW), harmony memory consideration rate (HMCR), and pitch adjustment rate (PAR). In this method, the length of harmony was the amount of samples chosen in the data set. It utilizes a real encoded model for representing all bits of harmony 20 . To harmony vector representation, all bits are allocated with the real number drawn in the search with lower bound and upper bound with the total number of features (TNF) and rounded for integrating value demonstrating the feature index. Supposing when harmony length is 10 afterward all bits are signified with arbitrary real number amongst l to TNF. The fitness value of all harmony is estimated consider classification error as FF signified as: where, fit(Value 1 ) and fit(Value 2 )are fitness values, and HMS is harmony memory size . The current harmony was improvised from the subsequent ways for j = 1 to N, where N refers to the size of population.
if (rand(O, 1) < HMCR) where g signifies the all sample index and f = 1,2, 3, · · · , HMS if (rand(O, 1) < PAR) At this point, the float number optimized technique was utilized to feature representations. Thus, all index from the harmony represents a feature. According to this probability of features from the feature subset, feature index was computed utilizing distribution factors under all samples ration improvisation signified as FD g j is provided by where PD j refers the amount of times feature j is approaching in optimum and ND j defined the amount of times feature j was coming in a worse subset. The superior probability feature is maximum possibilities to come from the last subset. Eventually, according to the end condition (the amount of iterations or tolerable classification error) improvisation was completed and decreased the group of features is chosen under this phase. When fit(g new (j) is superior to fir (worst) afterward upgrade harmony as: The last of all iterations the parameters PAR, HMCR, and BW are altered from the subsequent manner Utilizing in Eq. (7), a sigmoidal transformation was executed to these components for bringing the value as to range. This work illustrates the multistage FS technique executing the benefits of both wrapper and filter approaches.

Design of ABi-GRNN technique.
At the time of intrusion detection and classification process, the ABi-GRNN technique has been developed for the identification of intrusions in the CPS environment. The conventional recurrent neural network (RNN) model handles the sequence problem with the utilization of earlier data based on the forward input series and does not considers the succeeding data. For resolving this issue, the BiRNN model has been developed by memorizing the previous and latter data. The major concept is to utilize a pair of RNNs in processing forward as well as reverse sequences, respectively. The outcome is afterward linked to the identical output layer and thereby the bi-directional contextual data for the feature sequence can be saved 21 . The Bi-GRNN technique is attained by replacing the hidden layer neuron in the BiRNN with GRU memory unit. At time t , the hidden layer of Bi-GRNN provides h t and it can be computed using Eqs. (8)- (10): where W implies weight matrix linking a pair of layers, b denotes the bias vector, σ indicates activation function, − → h t and ← − h t indicates the outcome of positive and negative GRU respectively. ⊕is element-wise sum. The attention method was utilized in the ABi-GRNN technique for representing the correlation between the data and output. This technique was primary implemented for the task of machine translations. The feed-forward attention technique adapted during this case is a direct simplification of the convention attention system. The simplification technique is for constructing a single vector C in the complete order, generated as: where a refers to the learning function, and it can only define as h t . The attention process is assumed as generating a set length of embedding layer C of input order with computing an adaptive weighted average of order of the states h. It can be attain the last representation utilized to classifier from: Hyperparameter tuning using PRO algorithm. In order to adjust the learning rate, epoch count, and batch size of the ABi-GRNN technique, the PRO algorithm is employed. If learning rate is set manually too high then there may be a failure of convergence. On the other hand, if it is set too low, then convergence to a minimum could be very slow. It is projected dependent upon people wealth performances under the society 22 . Generally, the people is clustered as to two financial classes in a society. A primary group has of wealthier people (wealth has superior to average). The next group has of worse people (wealth was lesser than average). The rich economic class people attempt for extending its class gap with observed from individuals in worse economic class. During the optimized problems, all individual solution from the Poor population moves nearby the global optimum solutions from the search space by learned in the rich solution from the Rich population. Fitness function. The FF roles are an important play from the optimized issues. It computes a positive integer for representing an optimum candidate solutions. The classifier error rate was considered as minimized FF that is expressed in Eq. (17). The rich solution is minimal fitness score (error rate) and worse solution is maximum fitness score (error rate). where, χ is the length of all individual's solution (binary vector). The movement of the poor solution was determined in Eq. (19).

Results
The  Eventually, in terms of accuracy, the PRO-DLBIDCPS system has resulted in higher average accuracy (AAC) of 0.9858 while the BBFOGRU, optimal GRU, and GRU techniques have gained minimum AAC values of 0.9821, 0.9704, and 0.9687 respectively. Lastly, with respect to F-score, the PRO-DLBIDCPS technique has resulted in superior average F-score of 0.9826 but the BBFOGRU, optimal GRU, and GRU methods have obtained reduced average F-score values of 0.9755, 0.9732, and 0.9709 correspondingly. 100% precision values have been achieved by BBFOGRU and PRO-DLBIDCPS as training dataset is less or equal than testing dataset. It is due to ratio of training and testing datasets.
The accuracy outcome inspection of the PRO-DLBIDCPS technique on NSL-KDD-2015dataset is portrayed in Fig. 7. The results demonstrated that the PRO-DLBIDCPS technique has accomplished improved validation (17) fitness(χ i ) = ClassifierErrorRate(χ i ) = number of misclassified samples Toral number of samples * 100  Fig. 8. The results revealed that the PRO-DLBIDCPS approach has denoted the reduced validation loss over the training loss. It is additionally noticed that the loss values get saturated with the epoch count of epoch.     Followed by, with respect to accuracy, the PRO-DLBIDCPS algorithm has resulted in higher AAC of 0.9885 whereas the BBFOGRU, optimal GRU, and GRU methods have obtained lower AAC values of 0.9741, 0.9687, and 0.9644 respectively. At last, with respect to F-score, the PRO-DLBIDCPS system has resulted in superior average F-score of 0.9883 whereas the BBFOGRU, optimal GRU, and GRU models have obtained lower average F-score values of 0.9802, 0.9789, and 0.9751 correspondingly.
The accuracy outcome analysis of the PRO-DLBIDCPS approach on CICIDS-2017 dataset is illustrated in Fig. 10. The results exhibited that the PRO-DLBIDCPS system has accomplished improved validation accuracy compared to training accuracy. It is also observable that the accuracy values get saturated with the count of epoch.
The loss outcome analysis of the PRO-DLBIDCPS method on CICIDS-2017 dataset is depicted in Fig. 11. The figure exposed that the PRO-DLBIDCPS algorithm has denoted the lower validation loss over the training loss. It can be additionally noticed that the loss values were saturated with the epoch count of epoch.
The performance of the PRO-DLBIDCPS technique can be compared with recent methods 25 in terms of ACCU Y in Fig. 12 and Table 2. The results indicated that the chaotic particle swarm optimization (CSPSO) algorithm has resulted in least ACCU Y of 0.7460. At the same time, the Multi layers intrusion detection system (MLIDS) and deep neural network support vector machine (DNN-SVM) models have resulted in slightly enhanced ACCU Y of 0.9377 and 0.9300 respectively. Along with that, the Decision Tree (DT), CO-algorithm, Genetic-Fuzzy, and Fuzzy C Means (FCM) models have attained moderately increased ACCU Y of 0.9661, 0.9810, 0.9720, and 0.9710 respectively. Though the BBFO-GRU technique has resulted in near optimal ACCU Y of 0.9885, the proposed PRO-DLBIDCPS technique has outperformed the other ones with the higher ACCU Y of 0.9885. Table 3 provides the time complexity analysis of the PRO-DLBIDCPS technique with recent approaches in terms of training time (TGT) and testing time (TST). Figure 13

Conclusion
In this study, a new PRO-DLBIDCPS technique has been developed for intrusion detection in the CPS environment. The PRO-DLBIDCPS technique encompasses different processes namely pre-processing, AHSA for election of features, ABi-GRNN classifier, and PRO hyperparameter optimizer. The detection efficiency of the ABi-GRNN technique has been enhanced by the use of PRO algorithm based hyperparameter optimizer, which results in enhanced intrusion detection results. Also, the inclusion of blockchain technology helps in enhancing security in the CPS environment. A wide ranging simulation analysis is performed to ensure the enhanced performance of the PRO-DLBIDCPS technique in terms of several measures. The comprehensive comparative results reported the better outcomes of the PRO-DLBIDCPS technique in terms of several measures. In future, data clustering and feature reduction techniques can be integrated to the PRO-DLBIDCPS technique for accomplishing maximum security in the CPS environment.